National Center for Forensic Science
A program of the National Institute of Justice hosted by the
University of Central Florida
 Forensic Resource Network  

 
   


Training

All NCFS Training:

Training Calendar
Upcoming Training Opportunities of Interest to the Forensic Science,
Law Enforcement, and Public Safety Communities

Dates:
 November 3-7, 2008
Course Title:
 Comprehensive Fire Debris Analysis
Description:

This course teaches fire scene matters as they relate to laboratory analysis of fire debris; organic chemistry; extraction methods for fire debris; analysis of neat petroleum and ignitable liquid extractants, particularly mass spectral analysis; petroleum refinery operations; report writing and testimony of fire debris analysts; and other topics related to fire debris analysis.

This course is Web-based, followed by the face-to-face workshop hosted by NCFS. The online portion of the course will begin in October 2008; successful completion of the course requires participation in online activities, the completion of online assessments, and attendance at the face-to-face component scheduled for November 2008.
Prerequisites:

In general, the prerequisites are a chemistry degree or general, analytical, and organic chemistry college coursework; one year conducting fire debris analysis or other forensic laboratory experience using mass spectral analysis.

Students must complete all online activities/assessments before attending the scheduled November 2008 workshop component of the course.

Location and
Duration:

NCFS / Room 221 and Room 315

8am-5pm
Instructors:

Julia Doland, ATF Laboratory; Reta Newman, Pinellas Co, FL Medical Examiner’s Laboratory; Class Administrator Steve Allen, retired FBI, contracted by NCFS.

Costs:
 2008 course is cost-free thanks to National Institute of Justice grant.
Application:
 Print application here and fax it to 407-823-3162. For questions, contact Steve Allen at 804-224-2748.



Dates:
 March 23, 2009
Course Title:
 2009 TWGFEX Fire and Explosions Symposium
Description:

This is a one-day symposium for fire and explosion laboratory analysts and scene investigators will feature presented papers of interest to each group. The symposium will be followed by a number of workshops. This symposium is sponsored by the National Center for Forensic Science (NCFS), hosted by University of Central Florida (UCF) and funded by the National Institute of Justice (NIJ). The symposium has been organized by members of the Technical Working Group for Fire and Explosions (TWGFEX). The symposium will feature invited speakers who will present papers on issues of interest to laboratory and scene personnel. Topics of interest to investigators will include: Introduction to Peroxide Explosives Manufacturing; Computer Fire Modeling; Chemical Incendiaries and Hypergolic Mixtures; Understanding Ignitable Liquid Classifications and Why They are Used; Explosion Investigation and Reconstruction Using Multi Disciplinary Methods; Location, Recovery, and Analysis of DNA on Post Bomb Fragments; Identification of Smokeless Powders by a Variety of Analytical Methods; Wound Patterns from Blast Effects; and How Pyrotechnics Are Measured. The symposium will be followed by workshops on Explosives Debris Analysis, Fire Debris Analysis, Fire Dynamics, Organic Chemistry for Fire Debris Analysts, and Post-Blast Investigation – the length of time for each workshop will vary.
Prerequisites:

The one-day symposium is open to the general public (attendance at the symposium is a co-requisite for all students enrolled in the five courses whose workshops following the symposium). Space is limited, and applicants will be accepted on a “first come, first serve” basis.

Location and
Duration:

Florida Hotel and Conference Center
1500 Sand Lake Road
Orlando, Florida 32809

Telephone (407) 816-5182, fax (407) 855-9863 Website: www.thefloridahotelorlando.com
Instructors:

Invited speakers represent ATF, FBI, U. S. Postal Service, various state/local agencies and laboratories, and instructors from colleges/universities.
Costs:

Registration for the symposium is free courtesy of the National Institute of Justice.

Note – students registered to attend the workshops at the Florida Hotel and Conference Center the week of March 23, 2009 will automatically be registered to attend the symposium.
(a prerequisite for successfully completing any of the five workshops being offered)
Application:
 Print application here and fax it to (407) 823-3162. For general inquiries, contact NCFS at (407) 823-6469.



Dates:
 March 23-27, 2009
Course Title:
 Comprehensive Fire Debris Analysis
Description:

This course is Web-based, followed by the face-to-face workshop held at the Florida Hotel and Conference Center in Orlando, Florida. The online portion of the course will begin in January/February 2009; successful completion of the course requires participation in online activities, the completion of all online assessments, attending the 2009 TWGFEX Fire and Explosions Symposium (March 23, 2009), and attendance at the face-to-face component of the course scheduled for March 24-27, 2009.
Prerequisites:

Students must complete all online components of the course, as well as attend the 2009 TWGFEX Fire and Explosions Symposium (March 23, 2009) before attending the face-to-face component of the course scheduled for March 24-27, 2009.
Location and
Duration:

Florida Hotel and Conference Center
1500 Sand Lake Road
Orlando, Florida 32809

Telephone (407) 816-5182, fax (407) 855-9863 Website: www.thefloridahotelorlando.com
Instructors:

Invited speakers represent ATF, FBI, U. S. Postal Service, various state/local agencies and laboratories, and instructors from colleges/universities.
Costs:

Registration for the symposium is free courtesy of the National Institute of Justice.

Note – students registered to attend the workshops at the Florida Hotel and Conference Center the week of March 23, 2009 will automatically be registered to attend the symposium.
(a prerequisite for successfully completing any of the five workshops being offered)
Application:
 Print application here and fax it to (407) 823-3162. For general inquiries, contact NCFS at (407) 823-6469.



Dates:
 March 23-24, 2009
Course Title:
 Organic Chemistry for Fire Debris Analysts
Description:

This course covers structure, nomenclature, and reactions of organic molecules with particular emphasis on fire science; fire dynamics; combustion theory; thermal degradation of organic molecules; polymers and their impact on fire scenes and analysis; petroleum refining and petrochemical operations; mass spectrometry, other analytical methods, and emerging methods for organic analysis; and interpretation of results.

This course is Web-based, followed by the face-to-face workshop held at the Florida Hotel and Conference Center in Orlando, Florida. The online portion of the course will begin in January/February 2009; successful completion of the course requires participation in online activities, the completion of all online assessments, attending the 2009 TWGFEX Fire and Explosions Symposium (March 23, 2009), and attendance at the face-to-face component of the course scheduled for March 24, 2009.
Prerequisites:

In general, the prerequisites are a chemistry degree or general, analytical, and inorganic and organic chemistry college coursework; one year conducting fire-debris analysis or other forensic chemistry experience.

Students must complete all online components of the course, as well as attend the 2009 TWGFEX Fire and Explosions Symposium (March 23, 2009) before attending the face-to-face component of the course scheduled for March 24, 2009.
Location and
Duration:

Florida Hotel and Conference Center
1500 Sand Lake Road
Orlando, Florida 32809

Telephone (407) 816-5182, fax (407) 855-9863 Website: www.thefloridahotelorlando.com
Costs:
 The 2009 course is being presented in conjunction with the 2009 Annual Symposium of the National Center for Forensic Science and in that regard is cost-free based on a grant from the National Institute of Justice.
Application:
 Print application here and fax it to 407-823-3162. For questions, contact Steve Allen at 804-224-2748.



Dates:
 March 24-27, 2009
Course Title:
 Explosives Debris Analysis and Analysis of Intact Explosives
Description:

This course covers analysis of intact explosives and analysis of debris for the presence of post-blast explosives; the chemistry of explosives; the use of instrumentation germane to explosives analysis; extraction methods for explosives debris; explosives manufacturing operations; report writing and testimony of explosives analysts; and other topics related to explosives analysis.

This course is Web-based, followed by the face-to-face workshop held at the Florida Hotel and Conference Center in Orlando, Florida. The online portion of the course will begin in January/February 2009; successful completion of the course requires participation in online activities, the completion of all online assessments, attending the 2009 TWGFEX Fire and Explosions Symposium (March 23, 2009), and attendance at the face-to-face component of the course scheduled for March 24-27, 2009.
Prerequisites:

In general, the prerequisites are a chemistry degree or general, analytical, and inorganic and organic chemistry college coursework; one year conducting explosives debris analysis or other forensic laboratory experience using mass spectral, infrared, x-ray diffraction, and other instrumental methods of analysis.

Students must complete all online components of the course, as well as attend the 2009 TWGFEX Fire and Explosions Symposium (March 23, 2009) before attending the face-to-face component of the course scheduled for March 24-27, 2009.
Location and
Duration:

This course is taught at the National Center for Forensic Science, University of Central Florida Research Park, 12354 Research Parkway, Orlando, Florida 32826; 8 am to 5 pm. The mailing address is Post Office Box 162367, Orlando, Florida 32816-2367.
Costs:
 Florida Hotel and Conference Center
1500 Sand Lake Road
Orlando, Florida 32809

Telephone (407) 816-5182, fax (407) 855-9863 Website: www.thefloridahotelorlando.com
Application:
 Print application here and fax it to 407-823-3162. For questions, contact Steve Allen at 804-224-2748.



Dates:
 March 23-24, 2009
Course Title:
 Post Bomb Blast Investigation
Description:

This web based course will provide training in the processing of explosion scenes, taking the student through the logical progression from developing a plan of standard operating procedures utilizing NIMS, identifying and collecting evidence at the crime scene, documentation methods, proper submission of evidence to the Laboratory, and presentation of evidence through a legal and/or administrative briefing exercise.

The course will provide the student specialized knowledge to analyze explosions involving condensed-phase explosives. This includes a foundation in the theory of explosive effects, explosives terminology, explosive products, improvised explosive devices, post-blast identification of bomb components, bomb reconstruction and intercomparisons, forensic capabilities in bomb cases, and laws relating to explosives/bombings identifying jurisdictional guidelines.

The following modules comprise the course:

  • Describe Explosions
  • Effectively manage and process a pre-blast scene
  • Describe Explosives
  • Recognize common and frequently used commercial explosives
  • Identify pre & post blast IED components
  • Based on existing guidelines, tailor SOP for processing a pre- and post-blast scene investigation for student’s jurisdiction
  • Effectively manage and process a post blast scene within context of NIMS
  • Blast scene equipment
  • Know the capabilities of forensic Laboratories for analysis of bomb evidence
  • Know state and federal laws relating to explosions, explosives, destructive devices, jurisdictional, and investigative response.

This course is Web-based, followed by the face-to-face workshop held at the Florida Hotel and Conference Center in Orlando, Florida. The online portion of the course will begin in January/February 2009; successful completion of the course requires participation in online activities, the completion of all online assessments, attending the 2009 TWGFEX Fire and Explosions Symposium (March 23, 2009), and attendance at the face-to-face component of the course scheduled for March 24, 2009.
Prerequisites:

Be familiar with the Guide for Explosion and Bombing Scene Investigation, U. S. Department of Justice, 2000. http://www.ojp.usdoj.gov/nij or http://ncfs.ucf.edu/twgfex/documents.html

Completion of National Incident Management System Incident Command System (NIMS ICS) course series 100, 200, 400 and 700. (If the student has not completed those courses, they can be accessed at the following address www.fema.gov/emergency/nims). Once completed, the certificate should be uploaded as verification that the course was completed.

Students must complete all online components of the course, as well as attend the 2009 TWGFEX Fire and Explosions Symposium (March 23, 2009) before attending the face-to-face component of the course scheduled for March 24, 2009.

Location and
Duration:

Florida Hotel and Conference Center
1500 Sand Lake Road
Orlando, Florida 32809

Telephone (407) 816-5182, fax (407) 855-9863 Website: www.thefloridahotelorlando.com
Costs:
 There is no cost for the selected students. This course is being presented in conjunction with the 2009 Annual Symposium of the National Center for Forensic Science and in that regard is cost free based on a grant from the National Institute of Justice.
Application:
 Print application here and fax it to 407-823-3162. For questions, contact Tom Minnich tminnich@mail.ucf.edu



Dates:
 March 23-24, 2009
Course Title:
 Fire Dynamics
Description:

This web based is being developed and will help investigators solve some of the challenges facing them in preparing a technically defensible fire investigation.

Understanding fire dynamics is critical to a fire investigator when determining the origin and cause of fires. The overall objective for the course is to give the student the tools and ability to utilize the phenomena of fire dynamics in their day-to-day investigation of fires and explosions. This course will permit the student to gain this knowledge through the web and permit that student to complete it at his or her own pace. By completion of the course the student will have the knowledge to:

  • Define fire
  • Understand basic fire physics and chemistry
  • Understand heat transfer and fluid dynamics
  • Define and understand smoldering, pre-mixed flames, diffusion and fires caused by spontaneous combustion
  • Understand Ignition as it relates to solids, liquids and gases
  • Understand how fire develops both in confined and unconfined areas
  • Understand flashover and back draft and how it impacts on scene investigation
  • Develop skills to utilize fire modeling programs and the value of using those programs in investigations and limitations of using fire modeling in court
  • Understand and utilize how fire dynamics are used in overall fire/explosive investigations

This course is Web-based, followed by the face-to-face workshop held at the Florida Hotel and Conference Center in Orlando, Florida. The online portion of the course will begin in January/February 2009; successful completion of the course requires participation in online activities, the completion of all online assessments, attending the 2009 TWGFEX Fire and Explosions Symposium (March 23, 2009), and attendance at the face-to-face component of the course scheduled for March 24, 2009.
Prerequisites:

In general, students must be active fire investigators. They must commit to completing the entire web based course and provide feed back at the March 23, 2009 symposium.

Students must complete all online components of the course, as well as attend the 2009 TWGFEX Fire and Explosions Symposium (March 23, 2009) before attending the face-to-face component of the course scheduled for March 24, 2009.
Location and
Duration:

Florida Hotel and Conference Center
1500 Sand Lake Road
Orlando, Florida 32809

Telephone (407) 816-5182, fax (407) 855-9863 Website: www.thefloridahotelorlando.com
Costs:
 There is no cost for the selected students. This course is being presented in conjunction with the 2009 Annual Symposium of the National Center for Forensic Science and in that regard is cost free based on a grant from the National Institute of Justice.
Application:
 Print application here and fax it to 407-823-3162. For questions, contact Tom Minnich tminnich@mail.ucf.edu



Dates:
 September 9-11, 2008
Course Title:
 EnCase v6 Computer Forensics I
Description:
 This hands-on course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the EnCase forensic software. This course builds upon the skills covered in the EnCase Computer Forensics I course and enhances the examiner's ability to work efficiently through the use of the unique features of EnCase.
*Students must understand evidence handling; the structure of the evidence file; creating and using case files; data acquisition methods including DOS based, hardware write protected, crossover cable and disk to disk; recovering deleted files and folders in a FAT environment; keyword searches across logical and physical media; creating and using EnCase bookmarks; file signatures and signature analysis; and locating and understanding Windows® artifacts. Delivery method: Group-Live.

Focusing on investigations common to the private sector, students will learn about the following:
  • How to create and use of logical evidence files
  • How to locate and recover deleted partitions and folders
  • How to conduct keyword searches and advanced searches using GREP
  • Students will gain an understanding of the EnCase Virtual File System (VFS) and Physical Disk Emulator (PDE)
  • Students will learn about the Windows® Registry
  • Students will learn how to deal with compound file types
  • How to export files, directories and entire volumes
  • How to identify files using hash values and building hash libraries
  • How to identify Windows XP operating system artifacts such as link files, recycle bin, and user folders
  • How to prepare reports and evidence for presentation in court
  • How to recover artifacts such as swap files, file slack, and spooler files
  • How to recover printed and faxed pages

Who Should Attend?

This course is intended for IT security professionals, litigation support and forensic investigators. Participants should have attended the EnCase Computer Forensics I.
Prerequisites:
 EnCase® Computer Forensics I. Advance preparation for this course is not
Location and
Duration:

NCFS / Room 222

8am-5pm
Costs:

Tuition is $2,995.00 per student Government training rate is $1,995.00 per student

Application:
 training@guidancesoftware.com or 626-229-9191



Dates:
 September 9- October 2, 2008
Course Title:
 Financial Strategies for Successful Retirement
Classroom Instruction on Money Management for People Ages 45-74
Description:

This recently updated and revised course will show you how to prepare for a financially secure retirement. Find out how to potentially increase your investment returns and maximize your retirement income. Discover strategies to protect your assets from inflation, estate and income taxes, and erosion due to long-term health care needs. Explore exciting lifestyle options including travel, healthy living, working retirement and lifelong learning. Financial Strategies for Successful Retirement will provide you with the in-depth information you need to plan and enjoy a comfortable retirement.

Your Instructors: This seminar is presented across North America by financial services professionals. They not only draw upon real-life experiences with numerous clients, they are also licensed in the areas of investment securities and insurance. Your local instructors are Larry Adkins, ChFC, Craig Townsend, ChFC, and Chris Bordner, Registered Representatives with MetLife Financial Services, member NASD and SIPC.

Course Materials: The course uses an illustrated, 204-page color workbook that is frequently updated to reflect the most current information available. It contains many practical exercises and examples, including stock tables, investment performance graphs, tax charts and compound interest calculators. Your workbook will help you learn key concepts discussed in class and will be a valuable reference tool for years to come.
Prerequisites:
 None
Location and
Duration:

NCFS Tuesday / Room 221 and Thursday /Room 102, 6-8:30pm

(Tuesdays- 4/8, 4/15, 4/22, 4/29) (Thursdays- 4/10, 4/17, 4/24, 5/1)
Costs:

Tuition: Tuition is $45 per person or per couple. A workbook fee of $30 is payable to the instructor on the first night of class. Couples may share workbooks. You must register in advance. Class size is limited.
Application:
 (407)882-0260 or click here for the website



Dates:
 November 11-13, 2008
Course Title:
 EnCase v6 Computer Forensics 2
Description:
 This hands-on course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the EnCase forensic software. This course builds upon the skills covered in the EnCase Computer Forensics I course and enhances the examiner's ability to work efficiently through the use of the unique features of EnCase.
*Students must understand evidence handling; the structure of the evidence file; creating and using case files; data acquisition methods including DOS based, hardware write protected, crossover cable and disk to disk; recovering deleted files and folders in a FAT environment; keyword searches across logical and physical media; creating and using EnCase bookmarks; file signatures and signature analysis; and locating and understanding Windows® artifacts. Delivery method: Group-Live.

Focusing on investigations common to the private sector, students will learn about the following:
  • How to create and use of logical evidence files
  • How to locate and recover deleted partitions and folders
  • How to conduct keyword searches and advanced searches using GREP
  • Students will gain an understanding of the EnCase Virtual File System (VFS) and Physical Disk Emulator (PDE)
  • Students will learn about the Windows® Registry
  • Students will learn how to deal with compound file types
  • How to export files, directories and entire volumes
  • How to identify files using hash values and building hash libraries
  • How to identify Windows XP operating system artifacts such as link files, recycle bin, and user folders
  • How to prepare reports and evidence for presentation in court
  • How to recover artifacts such as swap files, file slack, and spooler files
  • How to recover printed and faxed pages

Who Should Attend?

This course is intended for IT security professionals, litigation support and forensic investigators. Participants should have attended the EnCase Computer Forensics I.

Prerequisites:
 EnCase® Computer Forensics I. Advance preparation for this course is not
Location and
Duration:

NCFS / Room 222

8am-5pm
Costs:

Tuition is $2,995.00 per student, Government training rate is $1,995.00 per student
Application:
 training@guidancesoftware.com or 626-229-9191



Dates:
 December 9-11, 2008
Course Title:
 EnCase- Advanced Internet
Description:

Note: The content of this course is significantly different and we recommend that anyone who took the EnCase Internet & E-mail course prior to February 2004 now take EnCase Advanced Internet Examinations.

This hands-on course involves practical exercises and real-life simulations. The class focuses on the forensic evidence located on the computer belonging to the suspect and /or victim-- not online or cyber investigations. E-mails and the Internet are cornerstones of consumer and business computer use. Virtually all computer forensic examinations will involve analysis of e-mail and Internet artifacts, underscoring the need to understand the relevance of Internet and e-mail-based evidence recovered during examinations. Delivery method: Group-Live.

The course provides in-depth coverage on artifacts involving:
  • Peer-to-peer clients
  • Instant Messaging Clients
  • Trojan viruses
  • System Monitors/keyloggers
  • JavaScript exploits
  • Popular web browsers, such as Internet Explorer, Netscape, and Mozilla

Students will learn how to interpret Internet browser history, search engines, logs, and correctly rebuild web pages.

The course will enable students to recover and examine e-mail messages, headers, and attachments from widely used e-mail applications (Outlook®, America Online®, and Netscape®) and web-based e-mail providers. Students will also locate and examine artifacts from search engines, instant messaging clients, and newsgroups.
Prerequisites:
 EnCase Computer Forensics II or EnCE Certification
Location and
Duration:

NCFS / Room 222

8am-5pm
Costs:

Tuition is $2,995.00 per student, Government training rate is $1,995.00 per student
Application:
 training@guidancesoftware.com or 626-229-9191



Dates:
 January 27-29, 2009
Course Title:
 AccessData Bootcamp
Description:

This course provides students with the knowledge and skills necessary to install, configure, and effectively use the combined abilities of AccessData's Forensic Toolkit (FTK) and Password Recovery Toolkit (PRTK) to locate and examine email messages, deleted files, free space and file slack.

Additionally, students will learn how to search for and export graphic files, as well as export and gain access to encrypted files from multiple industry standard applications. Documenting digital media information and working with multiple forensic image formats are also explored.

This intermediate level, hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and Security and Network Administrators that are responsible for creating cases that examine, analyze, and classify digital evidence.

The AccessData BootCamp course includes an optional Practical Skills Assessment (PSA) that requires participants to apply concepts presented during the course to complete a practical exercise. Participants who successfully complete this exercise receive a certificate of PSA completion.

Prerequisites:

none
Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative



Dates:
 February 24-26, 2009
Course Title:
 Windows Forensics - XP
Description:

This course provides students with the knowledge and skills necessary to conduct an effective Windows based investigation. Attendees should already be conducting computer based investigations and be familiar with the AccessData suite of tools.

In addition to using advanced search and filtering techniques, students will use the Ultimate Toolkit (with the new Registry Viewer) to address the following Windows artifacts:

o The Recycled / Recycler Bin --- (deleted files, place-holders and INFO2 databases)
o File Meta Data and OLE Items --- (dates and times and file summary data)
o Print Spools and Remnants --- (print jobs and temp files that remain behind)
o Unallocated Data Carving --- (recovering files from unallocated and embedded space)
o Windows Log & Link Files --- (other system device access / login records)

Registry File Data - Using the new Registry Viewer - specifically:

o NTUSER.DAT / SYSTEM files --- (protected storage data / user info)
o SAM / SOFTWARE / SECURITY / SYSTEM --- (machine time bias / USER-SID / login)

Students will also learn how to gain access to files that have been encrypted with the Microsoft Encrypted File System (EFS) component, parse thumbnail lists from Windows and other popular applications, and more.

This advanced level, hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and security and network administrators who desire a greater understanding of the Windows registry and other various operating system artifacts as they relate to computer forensic investigations.

The Windows Forensics course includes an optional Practical Skills Assessment (PSA) that requires participants to apply concepts presented during the course to complete a practical exercise. Participants who successfully complete this exercise receive a certificate of PSA completion.

Prerequisites:

none
Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative


Dates:
 March 31- April 2, 2009
Course Title:
 Windows Forensics - Vista
Description:

This advanced AccessData workshop provides the knowledge and skills necessary to analyze Microsoft® Windows Vista™ operating system artifacts and file system mechanics using Forensic Toolkit (FTK), FTK Imager, Password Recovery Toolkit (PRTK), and Registry Viewer.

During this three-day workshop, participants will review the following:

o GUID Partition Tables. (GPT): Students will use FTK Imager to navigate the new GPT formatted drive partitioning scheme.
o File Structure Changes: Students will learn the mechanics of reparse and mount points in the Windows Vista file structure.
o BitLocker-Full Volume Encryption (FVE): Students will use FTK Imager and Windows Vista technology to decrypt and acquire a sector-by-sector image of an FVE drive.

Windows Vista Artifacts such as:

o Vista EFS -- Updated EFS Algorithms
o Recycle Bin -- Updated File Recovery Mechanics
o Thumbcache -- Enhanced Thumbs.db Functionality
o Activity History -- Local Machine and Browser Indices
o Link and Spool Files -- Structure and Content Changes
o Windows Event Logs -- Enhanced XML Output and Viewing
o Volume Shadow Copy -- Previous File Version Recovery (SVI)
o Windows Vista Registry
o NTUser.DAT Changes -- MRU and UserAssist Changes
o SAM Hive User Changes -- Domain and User Value Additions
o System USBStor Information -- Device Identification and Protection
o Auto Complete & Search Terms -- Updated for Vista & Internet Explorer 7

The workshop includes multiple hands-on labs that allow students to apply what they have learned in the workshop.

Prerequisites:
To obtain the maximum benefit from this workshop, attendees should be familiar with:
o Windows XP forensic analysis
o Windows NT file system (NTFS) mechanics
o FTK, FTK Imager and Registry Viewer

Course Materials and Software:
Attendees will receive reference documentation and workshop files.
Prerequisites:

Prerequisites:
To obtain the maximum benefit from this workshop, attendees should be familiar with:
o Windows XP forensic analysis
o Windows NT file system (NTFS) mechanics
o FTK, FTK Imager and Registry Viewer

Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative



Dates:
 May 5-7, 2009
Course Title:
 Internet Forensics
Description:
This course provides students with the knowledge and skills necessary to conduct an effective Internet application based investigation. Students should already be conducting computer based investigations and be familiar with the AccessData suite of tools. Internet based investigations experience would provide additional background knowledge but is not necessary. This is not an undercover investigations course - it is data recovery focused.

Students begin immediately working a missing person case initiated from an instant message found on the computer screen of the missing person. The case takes the student to several different machines with multiple internet chat, browsing and email platforms. In addition to using Password Recovery Toolkit (PRTK) to break sign-on passwords for the following Internet applications and Messengers:

o MSN Instant Messenger (including MSN Live)
o YAHOO Instant Messenger
o America Online and AOL Instant Messenger
o Internet Explorer and Firefox Auto-Complete
o Myspace
o Skype
o Internet Explorer 7 Intelliforms artifacts

Students will also utilize Forensic Toolkit (FTK) to locate and decrypt YAHOO Instant Messenger .DAT files, parse Internet Explorer .DAT files (History and Temporary Files) for hit rates, use counts and more - including Firefox history files, the download manager, user favorites, etc. Students will also parse America Online client files for user history, search terms, address books, buddy lists, email and more. Students will use the Registry Viewer to analyze Instant Messenger data such as:

o Shared file permission status and file transfer information
o Block or allow information for user contacts (buddy lists)
o Last user access information and Recent contacts via the messenger

This advanced level, hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and security and network administrators who desire a greater understanding of Internet artifact data recovery.

Courses outside North America include an overview of Peer to Peer file sharing programs such as Limewire and the network architecture on which they operate. America Online course content has been removed providing the ability for delegates to explore such forensic issues as:

o Examining P2P actvity log files
o Decrypting Kazaa registry search terms
o Determining download file sources
o Determining file and folder share status
o Decoding URL values for download file comparison by hash value

The Internet Forensics course includes an optional Practical Skills Assessment (PSA) that requires participants to apply concepts presented during the course to complete a practical exercise. Participants who successfully complete this exercise receive a certificate of PSA completion.		  
 
Prerequisites:

none
Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative



Dates:
 June 9-11, 2009
Course Title:
 Applied Decryption
Description:
This advanced AccessData training course provides the knowledge and skills necessary to use the Unicode compliant Password Recovery Toolkit (PRTK) and Distributed Network Attack (DNA) tools, as well as TACC and PORT devices to recover passwords from industry standard applications and systems. Attendees should already be conducting computer based investigations and be familiar with the AccessData suite of tools. FTK and Registry Viewer will also be utilized.

While learning how to create effective attack profiles that include biographical profile dictionaries, user-defined dictionaries and unicode compliant character searches, students will determine how several commonly applied encryption schemes work. Students will crack applications such as:

o ARJ
o PGP
o RAR
o Adobe
o WinZip
o Quicken
o CuteFTP
o BestCrypt
o Quickbooks
o VersaCheck
o Microsoft EFS
o Microsoft Money
o Stegonography Files
o SAM Logon Passwords
o Microsoft Office Applications
o and many others ...

Students will plan, install and use a Distributed Network Attack environment and use AccessData web crawling and passphrase generation technology to create Unicode and code-page dictionaries to enhance attack profiles.

Students will also utilize a “TACC” device and a “Portable Office Rainbow Table” (PORT) with a standalone machine to increase the ability to crack more difficult passwords in a reasonable amount of time. As a single TACC can emulate a small DNA network for a fraction of the cost, students will have more options for decryption technology from AccessData.

Cryptography systems will be explained and exploited using Rainbow Table technology. Public Key Infrastructure will be explained, and students will learn practical application of arrays, XOR, ciphers and more.

This advanced level, hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and security and network administrators who desire a greater understanding of password recovery and decryption technology in a stand-alone and / or distributed network environment.

The Applied Decryption course includes an optional Practical Skills Assessment (PSA) that requires participants to apply concepts presented during the course to complete a practical exercise. Participants who successfully complete this exercise receive a certificate of PSA completion.

Click on the link below to view the course syllabus:
http://www.accessdata.com/media/en_us/print/training/syllabus.apdec.en_us.pdf		  
 
Prerequisites:

none
Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative



Dates:
 July 7-9, 2009 (more information will be posted as it becomes available)
Course Title:
 MPE Analysis (Mobile Phone Examiner)
Description:
 TBA
Prerequisites:

TBA
Location and
Duration:

NCFS / Room 315

Costs:
 TBA
Application:
 TBA



Dates:
 August 4-6, 2009 (more information will be posted as it becomes available)
Course Title:
 Mac Forensics
Description:
 TBA
Prerequisites:

TBA
Location and
Duration:

NCFS / Room 315

Costs:
 TBA
Application:
 TBA



Dates:
 September 22-24, 2009
Course Title:
 AccessData Bootcamp
Description:

This course provides students with the knowledge and skills necessary to install, configure, and effectively use the combined abilities of AccessData's Forensic Toolkit (FTK) and Password Recovery Toolkit (PRTK) to locate and examine email messages, deleted files, free space and file slack.

Additionally, students will learn how to search for and export graphic files, as well as export and gain access to encrypted files from multiple industry standard applications. Documenting digital media information and working with multiple forensic image formats are also explored.

This intermediate level, hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and Security and Network Administrators that are responsible for creating cases that examine, analyze, and classify digital evidence.

The AccessData BootCamp course includes an optional Practical Skills Assessment (PSA) that requires participants to apply concepts presented during the course to complete a practical exercise. Participants who successfully complete this exercise receive a certificate of PSA completion.

Prerequisites:

none
Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative



Dates:
 October 6-8, 2009
Course Title:
 Windows Forensics - Registry
Description:

In the continually evolving Windows Forensics series, the Windows registry continues to be a major source of Windows related artifact and information storage. Having the proper knowledge of registry based artifacts can make or break an investigation. In this course, attendees will utilize AccessData technology while being exposed to:

• Registry hive, cell and “hbin” block construction
• Live registry file capture from a Windows environment
• Carving registry key information from dumped memory files
• Registry testing, analysis and reporting technology
• Registry back-ups (system Volume Information and Restore Points)
• Tracking Trojan Horse programs through a suspect registry
• Tracking file associations and class ID information
• Analyzing mounted device association (USB and other devices)
• Discovering machine compromise through registry infiltration
Prerequisites:

none
Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative



Dates:
 November 3- 5, 2009
Course Title:
 Windows Forensics - Vista
Description:

This advanced AccessData workshop provides the knowledge and skills necessary to analyze Microsoft® Windows Vista™ operating system artifacts and file system mechanics using Forensic Toolkit (FTK), FTK Imager, Password Recovery Toolkit (PRTK), and Registry Viewer.

During this three-day workshop, participants will review the following:

o GUID Partition Tables. (GPT): Students will use FTK Imager to navigate the new GPT formatted drive partitioning scheme.
o File Structure Changes: Students will learn the mechanics of reparse and mount points in the Windows Vista file structure.
o BitLocker-Full Volume Encryption (FVE): Students will use FTK Imager and Windows Vista technology to decrypt and acquire a sector-by-sector image of an FVE drive.

Windows Vista Artifacts such as:

o Vista EFS -- Updated EFS Algorithms
o Recycle Bin -- Updated File Recovery Mechanics
o Thumbcache -- Enhanced Thumbs.db Functionality
o Activity History -- Local Machine and Browser Indices
o Link and Spool Files -- Structure and Content Changes
o Windows Event Logs -- Enhanced XML Output and Viewing
o Volume Shadow Copy -- Previous File Version Recovery (SVI)
o Windows Vista Registry
o NTUser.DAT Changes -- MRU and UserAssist Changes
o SAM Hive User Changes -- Domain and User Value Additions
o System USBStor Information -- Device Identification and Protection
o Auto Complete & Search Terms -- Updated for Vista & Internet Explorer 7

The workshop includes multiple hands-on labs that allow students to apply what they have learned in the workshop.

Prerequisites:
To obtain the maximum benefit from this workshop, attendees should be familiar with:
o Windows XP forensic analysis
o Windows NT file system (NTFS) mechanics
o FTK, FTK Imager and Registry Viewer

Course Materials and Software:
Attendees will receive reference documentation and workshop files.
Prerequisites:

Prerequisites:
To obtain the maximum benefit from this workshop, attendees should be familiar with:
o Windows XP forensic analysis
o Windows NT file system (NTFS) mechanics
o FTK, FTK Imager and Registry Viewer

Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative



Dates:
 December 1-3, 2009
Course Title:
 Internet Forensics
Description:
This course provides students with the knowledge and skills necessary to conduct an effective Internet application based investigation. Students should already be conducting computer based investigations and be familiar with the AccessData suite of tools. Internet based investigations experience would provide additional background knowledge but is not necessary. This is not an undercover investigations course - it is data recovery focused.

Students begin immediately working a missing person case initiated from an instant message found on the computer screen of the missing person. The case takes the student to several different machines with multiple internet chat, browsing and email platforms. In addition to using Password Recovery Toolkit (PRTK) to break sign-on passwords for the following Internet applications and Messengers:

o MSN Instant Messenger (including MSN Live)
o YAHOO Instant Messenger
o America Online and AOL Instant Messenger
o Internet Explorer and Firefox Auto-Complete
o Myspace
o Skype
o Internet Explorer 7 Intelliforms artifacts

Students will also utilize Forensic Toolkit (FTK) to locate and decrypt YAHOO Instant Messenger .DAT files, parse Internet Explorer .DAT files (History and Temporary Files) for hit rates, use counts and more - including Firefox history files, the download manager, user favorites, etc. Students will also parse America Online client files for user history, search terms, address books, buddy lists, email and more. Students will use the Registry Viewer to analyze Instant Messenger data such as:

o Shared file permission status and file transfer information
o Block or allow information for user contacts (buddy lists)
o Last user access information and Recent contacts via the messenger

This advanced level, hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and security and network administrators who desire a greater understanding of Internet artifact data recovery.

Courses outside North America include an overview of Peer to Peer file sharing programs such as Limewire and the network architecture on which they operate. America Online course content has been removed providing the ability for delegates to explore such forensic issues as:

o Examining P2P actvity log files
o Decrypting Kazaa registry search terms
o Determining download file sources
o Determining file and folder share status
o Decoding URL values for download file comparison by hash value

The Internet Forensics course includes an optional Practical Skills Assessment (PSA) that requires participants to apply concepts presented during the course to complete a practical exercise. Participants who successfully complete this exercise receive a certificate of PSA completion.		  
 
Prerequisites:

none
Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative



Dates:
 January 17-24, 2009
Course Title:
 Forensics Evidence Collection
Description:

The US Fire Administrations-National Fire Academy Arson Programs is piloting its newest course during January 17-24, 2009 at its Emmitsburg, Md National Emergency Training Center.

This 6-day course, Forensic Evidence Collection, is geared towards the street level fire/arson investigator and the laboratory analyst. By blending the course audience, this will further promote the synergy, dynamics, cooperation and comaraderie among/between these two critical players in the overall scope of fire, arson/explosion investigations. Emphasis will be placed on a vareity of table top exercises, pracctical skills and presetnations that will provide the students with a full
knowledge of the forensic evidence process, roles and responsibilities associated with evience collection, documentation, packaging, processing and testing.
Prerequisites:

Fire/Arson investigators will have to have completed the NFA Fire Arson Origin and Cause Investigation course as a prerequisite for acceptance/attendance. Laboratory analysts will have to be a currently employed member of a federal, State or local lab. By blending the audience further illustrates the ever growing critical need for scene and lab personnel to work even closer together in solving cases presented for testing. Completion of this course will more than
enhance/support the develop of, or exansion between the coperative efforts of lab personnel and the actual scene investigation staff.

A maximum of 24 students will be accepted into this course with 12 from the investigation side and 12 from the lab side
Location and
Duration:

Students would arrive Saturday, January 17th, begin class on Sunday Jan 18 and graduate on Friday January 24 at 4:00 pm. Bus transportation to/from the Baltimore/Washington metropolitan area airports (BWI, Reagan National, Dulles International) will be provided by NFA.

Costs:
 Transportation costs will be reimbursed by the government for: roundtrip coach airfare; or if driving, 58.5 cents per mile up to State of departure cap. If driving departmental vehicle, reimbursement goes to employing agency. Meals will be at student or employing agency expense at rate of $129.30 for entire duration of stay. NFA provides housing at no charge.
Application:

For all interested parties, applcations are available from our website: usfa.dhs.gov and are due to NFA Office of Admissions, 16825 South Seton Avenue, Emmitsburg, MD 21727 via US Postal Service by end of business on October 31, 2008.

Should you have further questions, please contact the following: doug.williams@dhs.gov


NIJ The NCFS is a program of the Office of Justice Programs, National Institute of Justice hosted by the University of Central Florida.
University of Central Florida The University of Central Florida is a major metropolitan research university whose mission is to deliver a comprehensive program of teaching, research, and service. UCF is one of 10 universities in the State of Florida University system with an approximate enrollment of 45,000.

This page is maintained by
David Galat dgalat@mail.ucf.edu
Last update: August 21, 2008

Free Hit Counters
stats counter